SQUID Block exe file from https://*****.com/****.exe

aamdevan · 12-04-2013, 06:38 AM

Hi,

I don't know how to block downloading .exe and other files when access through https:// web sites..
for example:
https://s3.amazonaws.com/radview/Web...0.0.124.en.exe

My squid conf is
acl blockfileslist url_regex "/etc/squid/blockfiles"
http_access deny blockfileslist

vi /etc/squid/blockfiles
\.[Ee][Xx][Ee]$
\.[Aa][Vv][Ii]$
\.[Mm][Pp][Gg]$
\.[Mm][Pp][Ee][Gg]$
\.[Mm][Pp]3$
\.[Zz][Ii][Pp]$
\.[Rr][As][Rr]$
\.[Ii][Ss][Oo]$
\.[Mm][Ss][Ii]$
\.[Mm][Ss][Uu]$

Its not working for https://******* urls..

Working in http://******

Can any one help me??

acid_kewpie · 12-04-2013, 07:31 AM

HTTPS conenctions through squid are not decrypted by default. THey use the CONNECT method to establish a connection through squid, the contents of which it can not see. You would look towards SSL Bump in squid to get inside the secure connection http://wiki.squid-cache.org/Features/SslBump

aamdevan · 12-04-2013, 10:45 PM

Thanks for your reply Mr.Chris

I am not sure about this ssl-bump..can you give some example to block downloading .exe files

acid_kewpie · 12-05-2013, 02:15 AM

the blocking and the ssl bump have nothing in common. You should actually read the information on the link I posted.